{"record":{"id":"976dc5ff6dc99e04","repo":"hashicorp/packer","slug":"sigstore-bundle-does-not-contain-a-dsse-envelope-976dc5","errorCode":null,"errorMessage":"sigstore bundle does not contain a DSSE envelope","messagePattern":"sigstore bundle does not contain a DSSE envelope","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":357,"sourceCode":"\t}\n\n\tpolicyBuilder := sigstoreverify.NewPolicy(artifactPolicy, sigstoreverify.WithCertificateIdentity(identity))\n\tif _, err := verifier.Verify(bundle, policyBuilder); err != nil {\n\t\treturn fmt.Errorf(\"verify Sigstore bundle %q: %w\", policy.SigstoreBundlePath, err)\n\t}\n\n\treturn nil\n}\n\nfunc ensureBundleMatchesEnvelope(bundle *sigstorebundle.Bundle, envelope Envelope) error {\n\tbundleEnvelope, err := bundle.Envelope()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"extract DSSE envelope from Sigstore bundle: %w\", err)\n\t}\n\n\trawEnvelope := bundleEnvelope.RawEnvelope()\n\tif rawEnvelope == nil {\n\t\treturn fmt.Errorf(\"sigstore bundle does not contain a DSSE envelope\")\n\t}\n\n\tif rawEnvelope.PayloadType != envelope.PayloadType || rawEnvelope.Payload != envelope.Payload {\n\t\treturn fmt.Errorf(\"sigstore bundle payload does not match attestation\")\n\t}\n\n\tif len(envelope.Signatures) == 0 {\n\t\treturn fmt.Errorf(\"attestation envelope has no signatures\")\n\t}\n\n\tbundleSignature := bundleEnvelope.Signature()\n\tfor i, envelopeSignature := range envelope.Signatures {\n\t\tsignature, err := DecodeEnvelopeSignature(envelopeSignature)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"decode attestation envelope signature %d: %w\", i, err)\n\t\t}\n\n\t\tif bytes.Equal(bundleSignature, signature) {","sourceCodeStart":339,"sourceCodeEnd":375,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L339-L375","documentation":"The bundle parsed but its RawEnvelope() returned nil, i.e. no DSSE envelope content is present inside the bundle. Thrown because signature matching against the attestation is impossible without the envelope's payload and signatures.","triggerScenarios":"bundle.Envelope() succeeds but the underlying raw envelope object is nil — a bundle variant without an embedded DSSE envelope (message-signature-only bundle) reaches ensureBundleMatchesEnvelope.","commonSituations":"Wrong bundle type supplied (binary signature instead of attestation); an older tool produced a bundle shape the parser reads as envelope-less; hand-edited bundle JSON stripped the envelope.","solutions":["Use a bundle produced by attesting the DSSE envelope (must contain a dsseEnvelope object in its JSON)","Regenerate the bundle from the original signing pipeline rather than hand-editing","Validate the bundle JSON before passing it (jq '.dsseEnvelope' bundle.json)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"var probe struct {\n    DSSEEnvelope *json.RawMessage `json:\"dsseEnvelope\"`\n}\nb, _ := os.ReadFile(bundlePath)\nif err := json.Unmarshal(b, &probe); err != nil || probe.DSSEEnvelope == nil {\n    return fmt.Errorf(\"bundle %q lacks an embedded DSSE envelope\", bundlePath)\n}","typeGuard":"func hasDSSEEnvelope(bundle *sigstorebundle.Bundle) bool {\n    env, err := bundle.Envelope()\n    return err == nil && env.RawEnvelope() != nil\n}","tryCatchPattern":"if err := verify(...); err != nil {\n    if strings.Contains(err.Error(), \"does not contain a DSSE envelope\") {\n        // swap in a bundle produced by the attest flow\n    }\n}","preventionTips":["Check for .dsseEnvelope in bundle JSON before passing it","Never hand-edit bundle files","Regenerate bundles when upgrading signing tooling"],"tags":["sigstore","dsse","bundle"],"backgroundTag":"dsse-envelope-missing","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}